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Please amend the present application as follows: 
Claims 

The following is a copy of Applicant's claims that identifies language being added with 
underlining (" ") and language being deleted with strikethrough ("—")> as is applicable: 

1-9. (Canceled) 

1 0. (Cutrently amended) A method for controlling the execution of a child process 
created from a parent process, wherein the parent prooe30 is instrumontod by a software tool, the 
method comprising: 

.instrumenting a parent process; 

monitoring execution of the parent process with a process monitor to collect information 
as to the run-time behavior of the parent process: 

before a vfork system call is executed, receiving with the process mqxritQr indicia from 
the parent process that a vfork system call will be executed by the parent process; 

suspending execution of the parent process; 

extracting with the process monitor a process identifier from the indicia of tho vfork 
sys te efre att, the process identifier cotrooponding to identifying a child process to be generated by 
the parent process when the parent process executes the vfork system call; 

setting with the process monitor a process monitor thread to observe trace events 
generated by the child process; and 
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resuming execution of the parent process to enable the parent process to execute the vfork 
system cal l^and 

again suspending execution of the parent process . 

1 1 . (Currently amended) The method of claim 10, further comprising: 

watting for indicia that the child process has invoked at least one of an exec system call 
and an _exit system call or has been terminated by an operating system; and 

setting a process monitor thread to observe trace events generated bv the parent process; 

and 

resuming execution_of the parent process . 

12. (Canceled) 

13. (Currently amended) The method of claim 1 0, wherein receiving indicia 
comprises receiving a pre-fork event that includes a process identifier that identifies the child 
process. 

14-28. (Canceled) 

29. (Currently amended) A method for controllably switching a target process of a 
process monitor thread between an instrumented parent process and a child process generated by 
the parent process^ the method comprising: 

checking whether the successful initiation of the child process can be asserted; 
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when the successful initiation of the child process cannot be asserted, checking if 
the parent process responsible for creating the child process received indicia of a failure 
of a vfork system call designated to create the child process bv searching for a trace event 
while performing a non-blocking trace wait on the parent process ; 

when the indicia has not been received, 

waiting an amount of time before rechecking for the successful initiation of the 
child process; otherwise, 

notifying a software monitor of the unsuccessful initiation of the child process and 
resuming execution of the parent process; 
monitoring the parent process; 

otherwise, when the successful initiation of the child process can be asserted, 

monitoring the successfully created child process. 

30. (Previously presented) The method of claim 29, wherein the step of checking 
whether the successful initiation of the child process can be asserted comprises verifying the 
success of a trace event by using the process identifier of the child process- 

31. (Canceled) 

32. (Previously presented) The method of claim 29, fiirther comprising: 

aborting child process monitoring when the initiation of the child process is unsuccessful. 

33-34. (Canceled) 
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35. (Currently amended) A computer readable m e dium memory th ai stores a system, 
the system comprising: 

logic rosponcivo to a pr e fork e v e nt -4 ho pro fork ev e nt responsi vo to a vfork systonvoa l l 
wh e r e in tho pro fork event includ e s - indkia that id e ntifi e s; a child prooooo to b e created-m 
accordance with the vfork oyst e m call; 

a parent process configured to. before a vfor k call is executed bv the parent Process. 
generate a pre-foik event that contains a process identifier of a child process that will be spawned 
from Ifae pare nt process when the vfork system call is executed bv the parent process; and 

a process monitor c onfigured to receive the ore-fork event and process identifier before 
the vfork _^tem_call is executed bv the parent process* suspend execution of theparent process, 
and generate a process monitor thread that enables observation of trace events generatedbyMthe 
child process . 

36. (Canceled) 

37. (New) The method of claim 1, further comprising analyzing run-time data 
observed during execution of the patient process once it is determined that the parent process has 
generated at least one of an exec system call and an _exit system call or has been terminated by 
an operating system. 
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38. (New) The computer readable memory of claim 35, wherein the process monitor 
is further configured to generate a process monitor that enables observation of the parent process 
upon resumption of execution of the parent process after receipt of indicia that the child process 
has invoked at least one of an exec system call and an _exit system call or has been terminated by 
an operating system. 

39. (New) The computer readable memory of claim 38, wherein the process monitor 
is further configured to resume execution of the parent process. 
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